A stack-based buffer overflow and a kernel memory disclosure vulnerability have been discovered in the system call handlers of the camera driver for Android.
b68d4fd29bd7fda3b8ac2141cbb3ea29
*Description*
A stack-based buffer overflow and a kernel memory disclosure vulnerability
have been discovered in the system call handlers of the camera driver.
*CVE-2013-4738*
The camera post processing engine (CPP) and video processing engine (VPE)
provide an ioctl system call interface to user space clients for
communication. When processing arguments passed to the
VIDIOC_MSM_CPP_DEQUEUE_STREAM_BUFF_INFO or
VIDIOC_MSM_VPE_DEQUEUE_STREAM_BUFF_INFO ioctl subdev handlers, a user space
supplied length value is used to copy memory to a local stack buffer
without proper bounds checking. An application with access to the
respective device nodes can use this flaw to, e.g., elevate privileges.
Access Vector: local
Security Risk: high
Vulnerability: CWE-121 (stack-based buffer overflow)
*CVE-2013-4739*
The Gemini JPEG encoder and the Jpeg1.0 common encoder/decoder engines of
the camera driver are not properly initializing all members of a structure
before copying it to user space. This allows a local attacker to obtain
potentially sensitive information from kernel stack memory via ioctl system
calls.
Access Vector: local
Security Risk: low
Vulnerability: CWE-200 (information exposure)
*Affected versions*
All Android releases from CAF using a Linux kernel from the following heads:
- msm-3.4
- jb_3*
*Patch*
We advise customers to apply the following patches:
CVE-2013-4738:
-
https://www.codeaurora.org/cgit/quic/la/kernel/msm/commit/?id=c9c81836ee44db9974007d34cf2aaeb1a51a8d45
-
https://www.codeaurora.org/cgit/quic/la/kernel/msm/commit/?id=28385b9c3054c91dca1aa194ffa750550c50f3ce
CVE-2013-4739:
-
https://www.codeaurora.org/cgit/quic/la/kernel/msm/commit/?id=8604847927f952cc8e773b97eca24e1060a570f2
*Credits*
Reported by the researcher Jonathan Salwan and patched by Qualcomm
Innovation Center.
Comments
Subscribe to this comment feedNo comments yet, be the first!